Create MALW_TrickBot.yar

cc091cee · mmorenog · GitHub · 7455b01f · cc091cee
Commit cc091cee authored Jun 13, 2017 by mmorenog Committed by GitHub Jun 13, 2017
Show whitespace changes
Inline Side-by-side

Showing with 4 additions and 8 deletions

MALW_TrickBot.yar malware/MALW_TrickBot.yar +4 -8

No files found.
--- a/malware/MALW_TrickBot.yar
+++ b/malware/MALW_TrickBot.yar
@@ -6,8 +6,7 @@ rule MALW_trickbot_bankBot : Trojan
 {
 meta:
 author = "Marc Salinas @Bondey_m"
- description = "Detects Trickbot Banking
+ description = "Detects Trickbot Banking Trojan"
-Trojan"
 strings:
 $str_trick_01 = "moduleconfig"
 $str_trick_02 = "Start"
@@ -22,8 +21,7 @@ Trojan
 {
 meta:
 author = "Marc Salinas @Bondey_m"
-description = "Detects systeminfo
+description = "Detects systeminfo module from Trickbot Trojan"
-module from Trickbot Trojan"
 strings:
 $str_systeminf_01 = "<program>"
 $str_systeminf_02 = "<service>"
@@ -39,8 +37,7 @@ rule MALW_dllinject_trickbot_module : Trojan
 {
 meta:
 author = "Marc Salinas @Bondey_m"
-description = " Detects dllinject module
+description = " Detects dllinject module from Trickbot Trojan"
-from Trickbot Trojan"
 strings:
 $str_dllinj_01 = "user_pref("
 $str_dllinj_02 = "<ignore_mask>"
@@ -54,8 +51,7 @@ Trojan
 {
 meta:
 author = "Marc Salinas @Bondey_m"
-description = " Detects mailsearcher
+description = " Detects mailsearcher module from Trickbot Trojan"
-module from Trickbot Trojan"
 strings:
 $str_mails_01 = "mailsearcher"
 $str_mails_02 = "handler"